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CMOS 32-bit Micro-controller 


TMP94FD53F aw 
Preliminary 


TMP94FD53 is high-speed advanced 32-bit micro-controller developed for controlling equipment which 
processes mass data. 
TMP94FD853 is a micro-controller which has a high-performance CPU (900/H2 CPU) and various built-in I/Os. 
TMP94FD53 is housed in a 100-pin mini flat package. 
Device characteristics are as follows: 


1. Outline and Device Characteristics 


(1) CPU:32-bit CPU(Q00/H2 CPU) 

Compatible with TLCS-900,900/L,900/L1,900/Hs instruction code 

16Mbytes of linear address space 

Generalourpose register and register banks 

Micro DMA : &channels (250ns / 4bytes at fc = 20MHz, best case) 
(2) Minimum instruction execution time : 50ns(at ZOMHz) 

Internal data bus : 32-bit 
(3) Internal memory 

Internal RAM : 16K-byte 

Intemal ROM : 512K-byte Flash E2PROM 

3kK-byte Mask ROM ( for Flash boot mode) 
(4) Extemal memory expansion 
16Mbbyte linear address space (memory mapped I/O) 
Extemal data bus : 8bit(for extemal /O expansion) 
* Can't use upper address bus when built-in I/Os are selected 

(5) Memory controller 

Chip select output : 1 channel 
(6) &bit timer : 8 channels 

8-bit interval timer mode (8 channels) 

16-bit interval timer mode (4 channels) 

8-bit programmable pulse generation (PPG) output mode (4 channels) 

8-bit pulse width modulation (PVVM) output mode (4 channels) 
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16-bit timer : 2 channels 
16-bit interval timer mode 
16-bit event counter mode 
16-bit programmable pulse generation (PPG) output mode 
Frequency measurement mode 
Pulse width measurement mode 
Time differential measurement mode 
Serial interface : 2 channels 
V/O interface mode 
Universal asynchronous receiver transmitter (UART) mode 
Serial expansion interface : 2 channels 
Baud rate 8/4/2/0.5Mbps at fc=20MHz. 
Serial bus interface : 2 channels 
Clocked-synchronous 8-bit serial interface mode 
PC bus mode 
Can controller : 1channel 
Supports CAN version 2.0B. 
16 mailboxes 
10-bit A/D converter : 12 channels 
AID conversion time 8~sec @fc=20MHz. 
Total tolerance = 3LSB (excluding quantization error) 
Scan mode for all 12channels 
Watch dog timer 
Interrupt controller 
365 internal interrupts 
9 extemal interrupts 
VO Port : 7Opins 
Power supply voltage 
VCC5=5V+10% (4.5V to 5.5V) 
VCC3 = 3.3V+40.3V (BV to 3.6V) 
Operating temperature : -40°C to 85°C 
Package : P-LQFP100-1414-0.50C 
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900/H2 CPU 


16KB RAM 


512KB Flash-EEPROM 


3KB BOOT ROM 


Figure 1 TMP94FD53 block diagram 
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2. Pin Assignment and Functions 
2.1 Pin Assignment 


X 0 
ieee aes : 
co ee 

Tog wun rf ww rtnmnnneo mas g25 
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Figure 2.1 Pin Assignment 
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22 Pin names and functions 


The following table shows the names and functions of the input/output pins. 


DO..D7 (TTL) in/out |Data: Data bus 0 to 7. 
all oh <tc 
AO..A7 out Address: Address bus 0 to 7. 
Read: Ourputs strobe signal to read external memory. 
ee 
Write: Gutout robs signal to write data on pins. 
ia aa Port 72: VO Pot 72 VOprt 


in/out | Port 73: eee port. 
ICS out Chip select: Outputs “low” if address is within specified address area. 
Clock pura 2: CLKOUT?2 output 4 MHz clock at fe = 20 MHz. 
fe Eee 
marr Wait: Signal uased to request CPU bus wait. 


a Port Co: I/O port. 
Timer input 0: Input pin for timer 0. 
ts Interrpt request pin 1: Rising-edge interrupt request pin. 
a 
oe Timer ete L Outnat pin for timer 1. 
aaa Port C2: I/O port. 
T05 1 out Timer output 3 Output pin for timer 3. 
INT2 i Interrupt request pin 2: Rising-edge interrupt request pin. _f 
a4 int Port C3: I/O port. 
Timer input 4: Input pin for timer 4. 
— intern pt request pin 3: Rising-edge interrupt request pin. 
——————— 
ae Timer sabput 5 Output pin for timer 5. 


aa Port C5: I/O port. 
Timer output 7 Output pin for timer 7. 
Interrupt request pin 4: Rising-edge interrupt request pin. 
Port Do: VO port. 
Timer input 8 Input pin for timer 8. 
Interrupt request pin 5: Interrupt request pin with programmable rising/falling 
edge. (— 
Address: Address bus 8. = 2 
Port D1: I/O port. 
Timer input % Input pin for timer 9. 
Interrupt request pin 6: interrupt request pin with programmable rising/falling 


edge. 
Address: Address bus 9. 
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pins 
PD2 in/out | Port D2: I/O port. 
TO8 1 out Timer output 8 Output pin for timer 8 
Al0 out Address: Address bus 10. 
PD3 in/out | Port D3: VO port. 
TO9 1 out Timer output 9 Output pin for timer 9 
All out Address: Address bus 11. 


PD4 in/out |Port D4: VO port. 
TIA in Timer input A: Input pin for timer A 
INT7 1 mn Interrupt request pin 7: Interrupt request pin with programmable rising/falling 
edge. 
Al2 out Address: Address bus 12. 5 A 
PD5 in/out |Port D5: VO port. 
Timer input B Input pin for timer B. 
Al13 out Address: Address bus 13. 
PD6 in/out |Port D6: V/O port. 
TOA 1 out Timer output A: Output pin for timer A. 
Al4 out Address: Address bus 14. 
PD7 w/out |Port D7: I/O port. 
TOB 1 out Timer output B Output pin for timer B. 
Al5 out Address: Address bus 15. 
TXDO out Serial transmission data 0. 
RXDO in Serial receive data 0. 
PF2 in/out | Port F2: V/O port. 
SCLKO 1 in/out | Serial clock input/output 0. 
/CTSO in Serial data ready to send 0, (Clear-tosend) 
TXD1 out Serial transmission data 1. 
RXD1 in Serial receive data 1. 
in/out |Port F5: V/O port. 
1 in/out | Serial clock input/output 1. 
in Serial data ready to send 0. Clear-to-send) 
TX out CAN transmission data. 
i CAN receive data. 
A — 
0.AN7 i Analog input 0 to 7: AD converter input pins. 
8.AN11 i Analog input 8 to 11: AD converter input pins. 
PMO in/o Port MO: I/O port. 
SSO 1 i SEI slave select input 0. 
Al16 ou Address: Address bus 16. 
7 


PM1 
MOsIO 
Al 


ut 
t 
in/out | Port M1: 1/O port. 
in/out |SEI master output, slave input 0. 
out 


Address: Address bus 17. 
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in/out | Port M2: I/O port. 
MISOO ae SEI master input, slave output 0. 
Address: Address bus 18. 
a ae M3: V/O port. 
pcLxD oe EI clock input/output 0. 
ee Address bus 19. 
7 ni Port M4: V/O port. 
ree SEI slave select input. 
Address: Address bus 20. 
_ oa Port M5: V/O port. 
MOosri aoe SEI master output, slave input 1. 
A21 Address: Address bus 21. 


PM6 arr Port M6: I/O port. 
MISO1 eae SEI master input, slave output 1. 
A22 Address: Address bus 22. 


PM7 aE Port M7: I/O port. 
ea a SEI clock input/output 1. 
Address: Address bus 23 
sc infout |SBIi ‘ates 0: dacke during SIO mode 
a Port N1: I/O port. 
SBI interface 0: output data at SIO mode 
i SBI interface 0: data at ?}C mode 
INE a Port N2: I/O port. 
SBl interface 0: input data at SIO mode 
sc infu SBIi uiliseiles 0: clock at PC mode 
a inout |SBIi wtsitaos 1 dock during SIO mode 
PN4 de Port N4: I/O port. 
SO1 SBI interface 1: output data at SIO mode 
SDA1 ea SBI interface 1: data at PC mode 
PN5 a Port N5: I/O port. 
sii SBI interface 1: input data at SIO mode 
SCL1 aii SBl interface 1: clock at PC mode 


7 Non-maskable interrupt: Interrupt request pin with programmable falling o 


both falling and rising edge. ye \Vf- 


Interrupt request pin 0O: Interrupt request pin with programmable 
= ale 
ee ee 
TEST mode pins ‘Input “low” when using 
aovec | 1 | ~ [PweanpiypinieDomete 
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oe eee 
DVCC5 i ara Power supply pins 45V): Conect all DVCC5 pins to 5V power supply. 


pvsss | 4 | = __ [GND 5V: Connect all DVSS pins to GND OV). 
DVCC3 ie Se es Power supply pins 43.3V): Connect all DVCC pins to 3.3V power supply. 
lpvsss. | 4 |= [GND 3.3V: Connect all DVSS3 pins to GND.OV) 
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3. OPERATION 


This section describes the basic components, functions and operation of the TMP94FD53F. 


3.1 CPU 
The TMP94FD53F contains an advanced high-speed 32-bit CPU(900/H2 CPU) 


3.1.1 CPU Outline 


900/H2 CPU is high-speed and high-performance CPU based on 900/H CPU. 900/H2 CPU has 
expanded 32-bit internal data bus to process Instructions more quickly. 
Outline of 900/H2 CPU are as follows: 


fie = ee = OUTICPU 
20MHz 
1-clock access(50ns@20MHz) 


32-bit 1-clock access 
Internal I/O 8/16-bit 2-clock access 900/H2 I/O 
[ie ee 8/16-bit 5~6-clock access 900/L1 I/O 
(can insert some waits) 


Minimum Instruction 1-clock(50ns@20MHz) 
Execution Cycle 


Conditional Jump 2-clock(100ns@20MHz) 
Instruction Queue Buffer 


Instruction Set Compatible with TLCS-900, 900/L, 900/H, 
900/L1 and 900/H2. (NORMAL, MAX, MIN and 
LDX instruction are deleted) 


CPU mode 
Micro DMA 


3.1.2 Reset operation 


When resetting the TMP94FD538 microcontroller, ensure that the power supply voltage is 
within the operating voltage range, and that the internal high-frequency oscillator has 
stabilized. Then hold the RESET input Low for at least 20 system clocks( 41 s).At reset the 
clock doubler is bypassed and system clock operates at 5MHz(fe=20MHz). 

When the Reset has been accepted, the CPU performs the following: 
e Sets the Program Counter (PC) as follows in accordance with the Reset Vector 
stored at address FFFFOOH~FFFFO02H: 


PC<0~7> ¢€ data in location FFFFOOH 
PC<8~15> < data in location FFFF01H 
PC<16~23> < data in location FFFF02H 


e Sets the Stack Pointer (XSP) to OOOO0000H. 


¢ Sets bits <IFFO~IFF2> of the Status Register (SR) to 111 (thereby setting the 
Interrupt Level Mask Register to level 7). 


e Clears bits <RFPO~RFP1> of the Status Register to 00 (thereby selecting Register 
Bank 0). 
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When the Reset is released, the CPU starts executing instructions according to the 

Program Counter settings. CPU internal registers not mentioned above do not change 

when the Reset is released. 

When the Reset is accepted, the CPU sets internal I/O, ports and other pins as follows. 

e Initializes the internal I/O registers as table of “Special Function Register” in 
Section 5. 

e Sets the port pins, including the pins that also act as internal I/O, to 
General-Purpose Input or Output Port Mode. 


Internal reset is released as soon as external reset is released. 


The operation of memory controller cannot be insured until power supply becomes stable 
after power-on reset. The external RAM data provided before turning on the TMP94FD53F 
may be spoiled because the control signals are unstable until power supply becomes stable 
after power on reset. 


VCC5V 


VCC3.3V 


RESET 


; Max.1s Min.10ms, Min.0s i Max.1s 
<<———> +—_——_> —-s— 


Osc warm up time+Clock doubler stable time 


Figure 3.1 Power on Reset Timing Example 


3.1.3 Setting of TESTO,TEST1,AMO,AM1 


Connect TESTO,TEST1 pin to “GND” to use at NORMAL mode. 
Set TESTO pin to “1” and connect TEST1 pin to “GND” at boot mode for on board programming. 
Set AMO,AM1 pin to “1” to use. 


Table 3.1.2 Operation Mode Setup Table 


Gustin Mods Mode Setup input pin 
RESET At __ A i ESTO 


Single-chip Mode 


Se a ee 
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3.2 Memory Map 


Figure 3.2 is a memory map of the TMP94FD53. 


000000H 
Internal I/O 


(1 KByte) 
000100H 


000400H 
Internal RAM 

(16 KByte) 
004400H 


010000H 


External memory 


Provisional Emulator Control Area 


64K Byte 


F80000H 


512 KByte 
Internal ROM 


FFFFOOH 


FFEFFEH Vector table (256 Byte 


Direct area (n) 


64Kbyte area 
(nn) 


+ (Note1) 


16Mbyte area 


R +R8/16) 
R + d8/16) 


ao (Note2) 
(| = Internal area) 


Figure 3.2 Memory Map 


TMP94FD53 


Notel: Provisional emulator control area is for emulator, it is mapped FOOOOOH to F10000H 


address after reset. 


Note2: Don’t use the last 16-byte area (FFFFFOH to FFFFFFH). This area is reserved. 


Note3: On emulator WR signal and RD signal are asserted, when provisional emulator control 
area is accessed. Be careful to use external memory. 
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3.3 Flash Memory 


The standard JEDEC commands are used to electrically erase and program this flash 
memory. Once commands are entered, programming and erasure are automatically performed 
inside the chip. In addition, there are several methods for erasing the flash memory, so that it 
can be erased the entire chip collectively, one block at a time, or multiple blocks together. 


Features: 
e Program/erase power supply voltage e Block erase architecture 
DVCC 3=3.3V+0.3 V 4 Kbytes x 2 / 8 Kbytes x 1/ 
DVcc 5=5V+10% 16 Kbytes x 1/32 Kbytes x 15 
e Functions e Mode control 
Automatic program Based on standard JEDEC commands 


Automatic erase 
Automatic block erase 
Automatic multiblock erase 


Block structure: 


Memory block in Flash EEPROM 
Low 


Address 


High TMP94FD53 


Figure 3.3.1 Block structure of the Flash memory 
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Command Sequence: Flash memory access by the internal CPU 


(Single-boot and user-boot modes) 
Firsts: “'\seednd Bus: |) ThirdiBoe-| OE US ll cry eus Sixth Bus 


Write Cycle | Write Cycle | Write Cycle ReadiWrile Write Cycle | Write Cycle 
Sequence|Cycles Cycle 


reset 


Auto 
4 XAAA8H| AAH | x5554H | 55H |xAAA8H]| AOH PA 
program 
Auto chip 
ace XAAA8H| AAH | x5554H | 55H |xAAA8H] 80H |xAAA8H] AAH | x5554H | 55H |xAAA8H] 10H 
Auto block 
peas XAAA8H| AAH | x5554H | 55H |xAAA8H] 80H |xAAA8H]| AAH | x5554H | 55H BA 30H 


The addresses viewed from the CPU side are shown in the table below. 


Command CPU Address: A23 to AO 
Address 


| x | 


xXXXOH Flash 


a Pots tots fof+fotsfoloto 
So eos alee aloe as |r| 9 


FOH, AAH, 55H, AOQH, 80H, 10H, 30H: Command data. Written to DQ7 to DQO. 


RA: Read address 

RD: Read data output 

PA: Program address 

PD: Program data input 

BA: Block address. Each individual block is selected by a combination of A18, A17, A16, A15, A14, A13 
and A12. 


| Data is written to every quadplex address in units of words. 


*: The two reset commands each can reset the device to read mode. 


Hardware Sequence Flag List: Flash memory access by the internal CPU 


a 


Automatic operation under Auto erase 
execution (during erase hold time) 
fAutoerase | 


Time-out (automatic operation Auto program DQ7 inverted 
failed) fAutoerase | Toggle 


Note: DQ8 to DQ31 and DQO to DQ2 are “Don’t care.” 
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Block Erase Address Table: Flash memory access by the internal CPU 


Block Address in Single Chip Mode Se 
ear fe ft ft | H 1 x | x | x | FescooH errr | O1e000H O1FFFFH | se Kbytes _| 
PH {te | x | x | x | FoooccHre7rrFFH | o20000Ho27FFFH | 32Kbytes | 
PPA DPC retrace | seks 

BA4 otis 3] 
Pt [| H | x 
PH TL 
i 2 SEIS 
eee: 


za 
x 
Xx 
eae 
x | x 
eS 
Pe eae 
za 
oe | SEX 
Ea 
| x 
| x 
ae 
Le) 
LH 


el ae ee 
Eee el Be 
pH | tL | x | 
i | aca NIG &! 
PH | HK | HL 
Ei ae ee 
eee 


Basic Operation: Flash memory access by the internal CPU 


Broadly classified, this flash memory has two operation modes. 


These are “Read Mode” in which memory data is read out and “Automatic Operation Mode” in 
which memory data are automatically erased/rewritten. Automatic operation mode can be 
entered by executing a command sequence in read mode. No memory data can be read out 
during automatic operation mode. 


(1) Read 
To read data from the flash memory, place it in read mode. 
Immediately after power-on or when automatic operation has terminated normally, the 
flash memory goes to read mode. When automatic operation has terminated abnormally or 
you want read mode to be restored from the other mode, use the reset command that is 
described later. 


(2) Command write 
This flash memory uses JEDEC-complhant command control method provided for standard 
E2PROMs. Writing to the command register is accomplished by issuing a command 
sequence to the flash memory. The flash memory latches the entered address and data into 
the command register as it executes instructions. 
To enter command data, use DQ0 to DQ7. Inputs to DQ8 to DQ31 are ignored. 
If you want to cancel commands in the middle of a command sequence being entered, issue 
the reset command. Upon accepting the reset command, the flash memory resets the 
command register and enters read mode. Also, when an incorrect command sequence is 
entered, the flash memory resets the command register and enters read mode. 

(3) Reset (reset command) 
When automatic operation has terminated abnormally, the flash memory does not return 
to read mode. In this case, use the read/reset command to have the flash memory return to 
read mode. 
Also, if you want to cancel a command in the middle while entering it, you can use the 
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read/reset command. It clears the content of the command register. 


Auto program 

Write to the flash memory is performed quadplex address in units of long words. In Auto 
program operation, the program address and program data are latched every even 
addresses in units of words in the 4th bus write cycle of the command cycle. Upon latching 
the program data, the flash memory starts auto-programming. Once this operation begins, 
programming and program verification are automatically performed inside the chip. The 
status of Auto program operation can be confirmed by checking the hardware sequence flag. 
During Auto program operation, command sequences you enter cannot be accepted. 

In writing to the flash memory, the cells that contain data “1” can be turned to data “O”, but 
the cells that contain data “0” cannot be turned to data “1”. To change the data “0” cells to 
data “1”, you need to perform an erase operation. 

If Auto program fails, the flash memory is locked in that mode and does not return to read 
mode. This status can be confirmed by checking the hardware sequence flag. When in this 
state, the flash memory needs to be reset by the reset command. Since in this case writing 
to the address concerned has failed, the memory block that includes this address is faulty. 
Therefore, make sure this block will not be used. 


Auto chip erase 

Auto chip erase begins from the 6th bus write cycle of the command cycle ended. Once Auto 
chip erase starts, all addresses of the flash memory are preprogrammed with data “0”, with 
the contents then erased and verified for erasure. All this operation is performed 
automatically inside the chip. The status of Auto chip erase operation can be confirmed by 
checking the hardware sequence flag. 

During Auto chip erase operation, command sequences you enter cannot be accepted. 

If Auto chip erase fails, the flash memory is locked in that mode and does not return to read 
mode. This status can be confirmed by checking the hardware sequence flag. Reset the 
flash memory by using the reset command. The block in which the failure occurred cannot 
be detected. Therefore, you need to stop using the device or locate the faulty block by 
executing block erase. Make sure the faulty block thus found will not be used. 


Auto block erase and Auto multiblock erase 

Auto block erase begins from the 6th bus write cycle of the command cycle ended after an 
elapse of the erase hold time. Once Auto block erase starts, all addresses of a selected block 
are preprogrammed with data “0,” with the contents then erased and verified for erasure. 
All this operation is performed automatically inside the chip. To erase multiple blocks, 
repeat the 6th bus write cycle and while so doing, enter each block address and the Auto 
block erase command within the erase hold time. If any other command sequence than 
Auto block erase is entered during the erase hold time, the flash memory is reset and 
placed in read mode. The erase hold time is 50 us, and count starts each time the 6th bus 
write cycle has ended. The status of Auto block erase operation can be confirmed by 
checking the hardware sequence flag. 

During Auto block erase, command sequences you enter cannot be accepted. 

If Auto block erase fails, the flash memory is locked in that mode and does not return to 
read mode. This status can be confirmed by checking the hardware sequence flag. Reset the 
flash memory by using the reset command. If multiple blocks have been selected, the block 
in which the failure occurred cannot be detected. Therefore, you need to stop using the 
device or locate the faulty block by executing block erase for each block individually. Make 
sure the faulty block thus found will not be used. 
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(7) Hardware sequence flags 
The hardware sequence flag allows you to confirm the status of the flash memory automatic 


operation being executed. During automatic operation, data can read from memory at the 


same timing as in read mode. 
When the flash memory finishes automatic operation, it automatically returns to read 


mode. 


The operating status when automatic operation is being executed can be confirmed by 
checking the hardware sequence flag, and the status after automatic operation is 


completed can be confirmed by checking whether the data read from memory matches its 
cell data. 


1) 


2) 


3) 


4) 


DQ7 (DATA polling) 

The DATA polling function allows you to confirm the status of the flash memory 
automatic operation. The DATA polling output begins from the last bus write cycle of 
the automatic operation command sequence ended. During Auto program operation, 
the data that has been written to DQ7 is output after being inverted: after the 
operation is completed, the cell data in DQ7 is output. By reading data out of DQ7, you 
can identify the operating status. During Auto erase operation, data “O” is output from 
DQ7: after the operation is completed, data “1” (cell data) is output. If the automatic 
operation resulted in failure, DQ7 continues outputting the same data that was 
written to it during automatic operation. 

The flash memory frees address latch upon completion of operation, so that when you 
read data from memory you must enter the address to which data has been written or 
any block address being erased. 


DQ6 (toggle bit) 

In addition to DATA polling, you can use a toggle bit output function to recognize the 
status of automatic operation. 

Toggle output begins from the last bus write cycle of the automatic operation command 
sequence ended. This toggle is output to DQ6, with data “1” and “0” output alternately 
for each read cycle performed. When the automatic operation is completed, DQ6 stops 
outputting the toggle and instead, outputs its cell data. If the automatic operation has 
failed, DQ6 continues outputting the toggle. 


DQ5 Gnternal timer overtime) 

When performing automatic operation normally, the flash memory outputs a “O” to 
DQ5. If the automatic operation exceeds the flash memory’s internally predetermined 
time, the DQ5 output changes to a “1”. This means that the automatic operation did 
not terminate normally, and that the flash memory probably is faulty. 

However, when data “1” is written to the data “0” cell, DQ5 outputs a “1”, providing 
misleading information that the flash memory is faulty. (The flash memory is designed 
in such a way that although the data “1” cells can be turned to data “O” in program 
mode, the data “0” cells cannot be turned to data “1”.) In the above case, DQ5 is not 
showing that the flash memory is faulty, but that the method of command usage is 
incorrect. 

If the automatic operation did not terminate normally, the flash memory is locked and 
does not return to read mode. Therefore, reset the flash memory using the reset 
command. 

DQ3 (block erase timer) 

Auto block erase begins from the 6th bus write cycle of the command cycle ended after 
an elapse of the erase hold time 60 us). The flash memory out puts a “0” to DQ3 when 
in the erase hold time and a “1” when it starts erasing. When you want to add a block to 
be erased, enter it during the block erase hold time. Every time you enter the erase 


command for each block, the flash memory resets the block erase hold time and starts 
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counting over again. If the automatic operation resulted in failure, DQ3 outputs a “1”. 
5) RY/ BY (Ready / Busy) 
This function is not supported. 


Flash memory rewrite by the internal CPU 

Flash memory rewrite by the internal CPU is accomplished by using the command 
sequence and hardware sequence flags described above. However, since the built-in flash 
memory does not read data from its memory cells during automatic operation mode, the 
rewrite program must be executed external to the flash memory. 

There are two methods for flash memory rewrite by the internal CPU. One method uses the 
single-boot mode prepared in advance; the other method runs the usevr’s original protocol in 
single-chip mode (user boot). 


1) Single boot 

In this method, the microcomputer is started in single-boot mode and the flash memory 
is rewritten using the internal boot ROM program. In this mode, the internal boot ROM 
is mapped into an area that includes the interrupt vector table, and the boot ROM 
program is executed in that area. The flash memory is mapped into another address 
space separately from the boot ROM area. The boot ROM program mainly performs two 
operations: taking in the rewrite data by serial transfer and rewriting the flash 
memory. Single boot needs to be performed while interrupts are disabled. Make sure 
nonmaskable interrupts (e.g., NMI) also are disabled before performing single boot. 

For details, refer to Section 3.4, “Single Boot Mode.” 


2) User boot 

This method runs the user’s original flash memory rewrite program. Execute the 
program in single-chip mode (regular operation mode). In this mode too, the flash 
memory rewrite program must be executed in another address space separately from 
that of the flash memory. As in the case of single boot, nonmaskable and all other 
interrupts must be disabled before performing user boot. 

The flash memory rewrite program including routines for taking in the rewrite data 
and rewriting the flash memory needs to be prepared in advance. When in the main 
program, switch from regular operation to the flash memory rewrite operation, then 
execute the flash memory rewrite program you've prepared after expanding it into 
somewhere outside the flash memory area. For example, you can execute the flash 
memory rewrite program after expanding it from flash memory into internal RAM or 
after preparing it in external memory. 
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Flowchart: Flash memory access by the internal CPU 


Auto program 


Auto program command sequence 
(See the flowchart below) 


DATA polling, toggle bit 


Last address? 
Yes 
End of Auto program 


Address = Address + 4 
(quadplex address in units of long words 


Auto program command sequence (addresses/commands) 


xAAA8H/AAH 
x5554H/55H 


xAAA8H/AOH 


Quadplex program addresses 
(AO, A1 = 0)/program data 
(in units of long words) 
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Auto erase 
Auto erase nd sequence 
(See the flowchart below) 
DATA polling, toggle bit 
End of Auto erase 
Auto chip erase command sequence Auto block/multiblock erase command sequence 
(addresses/commands) (addresses/commands) 
XAAA8H/AAH XAAA8H/AAH 
x5554H/55H x5554H/55H 
XAAA8H/80H XAAA8H/80H 
XAAA8H/AAH XAAA8H/AAH 
x5554H/55H X5554H/55H 
Block Address/30H Assitional 
address input 
during Auto 
multiblock erase 
Block Address/30H (each within 50us) 
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DQ7 Data polling 


Read long words (DQ0 to DQ31) 
Addr. =VA 


DQ7 = data? 
No 


Read long words (DQ0 to DQ31) 
Addr.=VA 


DQ? = data? 
No 
Terminated abnormally 


Terminated normally 


Read long words (DQ0 to DQ31) 


Adar. = VA 
DQ7 = toggle? 
Yes 
Yes 


Read long words (DQ0 to DQ31) 
Addr. =VA 


DQ7 = toggle? 


Yes 
Terminated abnormally Terminated normally 
VA: During Auto program, it denotes the address being written to. 


During Auto chip erase, it denotes an arbitrary flash memory address 
During Auto block erase, it denotes a selected block address. 
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3.4 Single Boot Mode 


(1) Outline 
The TMP94F D538 has single-boot mode available as an on-board programming operation mode. 
When in single boot mode, the boot ROM is mapped into memory space. This boot ROM is a 
mask ROM that contains a program to rewrite the flash memory on-board. 
On-board programming is accomplished by first connecting the device’s SIO (channel 1) and 
programming tool (controller) and then sending commands from the controller to the target 
board. 
The boot program included in the boot ROM also has the function of a loader, so it can transfer 
program data from an external source into the device’s internal RAM. 
Figure 3.5.1 shows an example of how to connect the programming controller and the target 
board. 


Programming tool (Note) Target board 


i DVcc (5 V) DVcc (3 V) 
AM1 (31 pin) 


AMO (29 pin) 


100 V 


RESET (30 pin) 


TESTO (26 pin) 


RXD1 (62 pin) 
TXD1 (61 pin) 


TEST1 (28 pin) 
Vss 
DVss 


Figure 3.5.1 Example for Connecting Units for On-board Programming 
Note: One of the programming controllers supported for the TMP94FD53 is the AF200 (Advanced 
On-board Flash Microcomputer Programmer) from Yokogawa Digital Computer Co. For details, 
refer to the manual included with the AF200. 
Where to contact: 


North America 
Yokogawa Digital Computer America 
Tel : 408-244-1932 Fax : 408-244-1881 


European Area 
Ashling Microsystems Limited 


Tel : 353-61-334466 Fax : 353-61-334477 
Tel : 44-1256-811998 Fax : 44-1256-811761 
Korea 
KM DATA INC. 
Tel : 82-2-785-3929 Fax : 82-2-785-3117 
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(2) Mode settings 
To execute on-board programming, start the TMP94FD53 in single-boot mode. Settings 
necessary to start up in single-boot mode are shown below. 


TESTO =H 
TEST1 = 

AMO =H 

AM1 =H 
RESET = _ 


After setting the TESTO, TEST1, AM1, and AMO pins each to the above conditions, drive the 
signal input to the RESET pin high. The TMP94FD58 starts up in single-boot mode. 


(3) Memory map 
Figure 3.5.2 compares memory maps in single-chip and single boot modes. When in single boot 
mode, the internal flash memory is mapped into addresses 10000H through 8FFFFH, as 
shown here. 
You'll also find that the boot ROM (MROM) is mapped into addresses FFF400H through 
FFFFFFH. 


Single-Chip mode Single-boot mode 


000000H 000000H 


Intemal I/O 1 Kbytes Internal I/O 1 Kbytes 


000400H 000400H 


Internal RAM 16 Kbytes Internal RAM 16 Kbytes 


004400H 004400H 


External memory 


010000H 
Internal flash memory 
512 Kbytes 


O8FFFFH 
090000H 


External memory 


100000H 


External memory 


FFFOOOH 


F80000H 
FFF400H 
Internal flash memory Internal Boot ROM 
512 Kbytes 
FFFFFFH FFFFFFH 3 Kbytes 


Figure 3.5.2 Comparison of Memory Maps 


(4) Interface specifications 
The following shows the SIO communication format used in single-boot mode. 
Before on-board programming can be executed, the communication format on the 
programming controller side must also be set up in the same way as for the TMP94FD53. 
Note that although the default baud rate is 9,600 bps (@ fe = 20 MHz), it can be changed to 
other values as shown in Table 3.5.1. 


Communication channel: SIO channel 1 


Serial transfer mode: UART (asynchronous communication) mode, full-duplex 


communication 
Data length: 8 bits 
Parity it: None 
Stop bit: 1 bit 
Baud rate (default): 9,600 bps (@ fe = 20 MHz) 
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(5) Data transfer format 
Tables 3.5.1 through 3.5.6 show baud rate modification data, operation commands, and data 
transfer format in each operation mode, respectively. 
Also refer to the description of boot program operation in the latter pages of this manual as 
you read these tables. 


Table 3.5.1 Baud Rate Modification Data (@ fc = 20 MHz) 


Baud Rate (bps) 76800 62500 38400 31250 19200 9600 


Table 3.5.2 Operation Command Data 


Operation Command data Operation Mode 
Flash memory rewrite 
RAM loader 

Flash memory SUM 


Table 3.5.3 Boot Program Transfer Format (@fc = 20 MHz) (For Flash Memory Rewrite) 


Number of Transfer Data from Transfer Data from 
Bytes Baud. iale TMP94FD53 to Controller 
Teanetarred Controller to TMP94FD53 


ist byte Matching data 9600 bps — (Baud rate auto set) 
2nd byte — 9600 bps OK: Echoback data (5AH) 
NG: Nothing transmitted 
3rd byte Baud rate modification data 9600 bps —_ 
4th byte (See Table 3.5.1) 9600 bps OK: Echoback data 
— NG: A1H x 3, A2H x 3, A3H x 3 
63H x 3 
5th byte Operation command data (30H) | Changed new baud rate | — 
6th byte — Changed new baud rate | OK: Echoback data (30H) 


NG: A1H x 3, A2H x 3, A3H x 3, 


63H x 3 


SE eee 
NG: 64H x 3 

8th byte Extended Intel Hex format Changed new baud rate 

: (binary) 

nth — 2 byte 


i a a 
NG: Nothing transmitted 
a I Gd + 
NG: Nothing transmitted 
command data) 


*1: “xxHx3” denotes that operation stops after sending 3 bytes of xxH. 


*2: Refer to “Notes on Extended Intel Hex Format (Binary)” in the latter page of this manual. 


*3: Refer to “Notes on SUM” in the latter page of this manual. 
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Table 3.5.4 Boot Program Transfer Format (@fc = 20 MHz) (For RAM Loader) 


Number of 
Bytes 
Transferred 


Transfer Data from 
Controller to TMP94FD53 


Transfer Data from 


Baud Rate TMP94FD53 to Controller 


ist byte 
2nd byte 


3rd byte 


Ath byte 


5th byte 
6th byte 


7th byte 
8th byte 


9th byte 
10th byte 


11th byte 
12th byte 


13th byte 
14th byte 


15th byte 
16th byte 


17th byte 
18th byte 


19th byte 


m'th byte 
m'th + 1 byte 


nth — 2 byte 


Matching data 


Baud rate modification data 
(See Table 3.5.1) 


Operation command data —_ (60H) 


Address 23-16 
Password count 


in which to store 


Address 15-08 
Password count 


in which to store 


Address 07-00 
Password count 


in which to store 


Address 23-16 at which to start 
Password comparison 


Address 15-08 “ at which to start 
Password comparison 


Address 07-00 
Password comparison 


at which to start 


Password string 


Extended Intel Hex format 
(binary) 


9600 bps 
9600 bps 


9600 bps 
9600 bps 


Changed new baud rate 
Changed new baud rate 


Changed new baud rate 


Changed new baud rate 


Changed new baud rate 
Changed new baud rate 


Changed new baud rate 
Changed new baud rate 


Changed new baud rate 
Changed new baud rate 


Changed new baud rate 
Changed new baud rate 


Changed new baud rate 
Changed new baud rate 


Changed new baud rate 
Changed new baud rate 


(Baud rate auto set) 


: Echoback data (5AH) 
: Nothing transmitted 


: Echoback data 
: A1H x 3, A2H x 3, A3H x 3, 


62H x 3 


: Echoback data (60H) 
: A1H x 3, A2H x 3, A3H x 3, 


63H x 3 


: Nothing transmitted 
: A1H x3, A2H x 3, A3H x 3 


: Nothing transmitted 
: A1H x 3, A2H x 3, A3H x 3 


: Nothing transmitted 
: A1H x3, A2H x 3, A3H x 3 


: Nothing transmitted 
: A1H x3, A2H x 3, A3H x 3 


: Nothing transmitted 
: A1Hx 3, A2H x 3, A3H x 3 


: Nothing transmitted 
: AIH x 3, A2H x 3, A3H x 3 


: Nothing transmitted 


IG: A1H x 3, A2H x 3, A3H x 3 


a a Ga 5 
NG: Nothing transmitted 

cs aE iinet ~~ 
NG: Nothing transmitted 


PRAM |— Jump to the user program's start address 


*1: “xxHx3” denotes that operation stops after sending 3 bytes of xxH. 


*2: Refer to “Notes on Password” in the latter page of this manual. 


*3: Refer to “Notes on Extended Intel Hex Format (Binary)” in the latter page of this manual. 


*4: Refer to “Notes on SUM’ in the latter page of this manual. 


94FD53-24 


TOSHIBA Under Development (Preliminary) TMP94FD53 


Table 3.5.5 Boot Program Transfer Format (@fc = 20 MHz) (For Flash Memory SUM) 


se laes of Transfer Data from ee Taser Data irom 
eae Controller to TMP94FD53 TMP94FD53 to Controller 


ist byte Matching data 9600 bps (Baud rate auto set) 
2nd byte — 9600 bps : Echoback data (5AH) 
: Nothing transmitted 
3rd byte Baud rate modification data 9600 bps 
4th byte (See Table 3.5.1) 9600 bps : Echoback data 
— : A1H x 3, A2H x 3, A3H x 3, 
62H x 3 
5th byte Operation command data (90H) | Changed new baud rate 
6th byte — Changed new baud rate | OK: Echoback data (90H) 
NG: A1H x 3, A2H x 3, A3H x 3, 
63H x 3 


7th byte | Changed new baud rate | OK: SUM (High) 
NG: — 


8th byte Changed new baud rate | OK: SUM (Low) 
i NG: — 


n’th — 2 byte 


9th byte (Wait for the next operation | Changed new baud rate 
command data) 


*41: "xxHx3” denotes that operation stops after sending 3 bytes of xxH. 


*2: Refer to “Notes on SUM.” 


(6) Description of boot program operation 

When you start the TMP%4FD53 in single-boot mode, the boot program starts up. The boot 

program provides the functions described below. 

For details about these functions, refer to @ Flash memory rewrite program through @) Flash 

memory SUM command in the pages that follow. 

e Flash memory rewrite 
The flash memory is erased the entire chip 612 Kbytes) collectively. Then data are 
written to the specified flash memory addresses. The controller should send the write data 
in the Extended Intel Hex format (binary). 
If no errors are encountered till the end record, the SUM of 512 Kbytes of flash memory is 
calculated and the result is returned to the controller. 


e RAM loader 
The RAM loader transfers the data into the internal RAM that has been sent from the 
controller in Extended Intel Hex format. When the transfer has terminated normally, the 
RAM loader calculates the SUM and sends the result to the controller before it starts 
executing the user program. The execution start address is the first address received. This 
RAM loader function provides the user’s own way to control on-board programming. 
To execute on-board programming in the user program, you need to issue the flash 
memory command sequence described in the preceding section of this manual. (Must be 
matched to the flash memory addresses in single-boot mode.) 
The RAM loader command checks the result of password collation prior to program 
execution. If the passwords did not match, the program is not executed. 

e Flash memory SUM 
The SUM of 512 Kbytes of flash memory is calculated and the result is returned to the 


controller. 
The boot program does not support the operation commands to read data from the flash 
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memory. Instead, it has this SUM command to use. By reading the SUM, it is possible to 
manage Revisions of application programs. 


@ Flash memory rewrite command (Table 3.5.3) 


The receive data in the first byte is the matching data. When the boot program 
starts in single-boot mode, it goes to a state in which it waits for the matching data 
to receive. Upon receiving the matching data, it automatically adjusts the serial 
channels’ initial baud rate to 9,600 bps. 

The matching data is 5AH. 


The 2nd byte is used to echo back 5AH to the controller upon completion of the 
automatic baud rate setting in the first byte. If the device fails in automatic baud 
rate setting, it goes to an idle state. 


The receive data in the 3rd byte is the baud rate modification data. The seven 
kinds of baud rate modification data shown in Table 3.5.1 are available. Even 
when you do not change the baud rate, be sure to send the initial baud rate data 
(28h: 9,600 bps @fc = 20 MHz). 

Baud rate modification becomes effective after the echoback transmission is 
completed. 


The 4th byte is used to echo back the received data to the controller when the data 
received in the third byte is one of the baud rate modification data corresponding 
to the device’s operating frequency. Then the baud rate is changed. If the received 
baud rate data does not correspond to the device’s operating frequency, the device 
goes to an idle state after sending 3 bytes of baud rate modification error code 
(62H). 

The receive data in the 5th byte is the command data (30H) to rewrite the flash 
memory. 


The 6th byte is used to echo back the received data (in this case, 30H) to the 
controller when the data received in the 5th byte is one of the operation command 
data in Table 3.5.2. And the flash memory rewrite routine is called. If the received 
data is none of the operation command data, the device goes to an idle state after 
sending 3 bytes of operation command error code (63H). 


The transmit data in the 7th byte indicates whether collective erase (512 Kbytes) 
has terminated normally. When collective erase 612 Kbytes) has terminated 
normally, the device returns collective erase terminated normally code C€1H) to 
the controller. 

If an erase error occurs, the device goes to an idle state after returning three bytes 
of erase error code (64H) to the controller. 

The controller should send the next data to the device after receiving the collective 
erase terminated normally code (C1H). 

The receive data in the 8th byte through n’th — 2 byte are received as binary data 
in Extended Intel Hex format. No received data are echoed back to the controller. 
The flash memory rewrite routine ignores the received data until it receives the 
start mark (3AH for “:” ) in Extended Intel Hex format. Nor does it send error code 
to the controller. After receiving the start mark, the routine receives a range of 
data from data length to checksum and writes the received write data to the 
specified flash memory addresses successively. Since bits 23 to 16 of the address 
pointer during write are by default 00H, the first record type must always be an 
extended record. 

After receiving one record of data from start mark to checksum, the routine goes to 
a start mark waiting state again. 
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If a write error, receive error, or Extended Intel Hex format error occurs, the device 

goes to an idle state without returning error code to the controller. 

Because the flash memory rewrite routine executes a SUM calculation routine 

upon detecting the end record, the controller should be placed in a SUM waiting 
state after sending the end record to the device. 

The n’th — 1 and the n’th bytes are the SUM value that is sent to the controller in 
order of the upper byte and the lower byte. For details on how to calculate the SUM, 
refer to “Notes on SUM” in the latter page of this manual. The SUM calculation is 
performed only when no write error, receive error, or Extended Intel Hex format 
error has been encountered after detecting the end record. The time required to 

calculate the SUM of the 512 Kbytes of flash memory area is approximately 800 

ms at fe = 20 MHz. After SUM calculation, the device sends the SUM data to the 

controller. The controller should determine whether writing to the flash memory 
has terminated normally depending on whether the SUM value is received after 
sending the end record to the device. 


The receive data in the n’th + 1 byte, if rewriting terminated normally, places the 
device in a state waiting for the next operation command data. 


@)RAM loader command (Table 3.5.4) 


The transmit/receive data in the 1st through the 4th bytes are the same as in the 
case of flash memory rewrite commands. 

The receive data in the 5th byte is the RAM loader command data (60H). 

The 6th byte is used to echo back the received data (in this case, 60H) to the 
controller when the data received in the 5th byte is one of the operation command 
data in Table 3.5.2. Then the RAM loader routine is called. If the received data is 
none of the operation command data, the device goes to an idle state after 
returning three bytes of operation command error code (63H) to the controller. 


The receive data in the 7th byte is the data for bits 23 to 16 of the address in which 
the password count is stored. Three bytes of password count storage address are 
required. The data indicated by this address is the password count. Note that if the 
password count is equal to or less than 8, the command is canceled. 

Nothing is sent in the 8th byte to the controller when the data received in the 7th 
byte has no error. If a receive error is encountered, the device goes to an idle state 
after returning three bytes of relevant error code to the controller. 

The 9th through the 12th bytes respectively are bits 15 to 8 and bits 7 to 0 of the 
password count storage address and are the data used when a receive error is 
encountered to return error code to the controller. For these operations, refer to 
paragraphs 4 and 5 above. 

The receive data in the 13th byte are bits 23 to 16 of the address at which the 
password comparison is started. Three bytes of password comparison start address 
are required. Passwords are compared beginning with this address. 

Nothing is sent in the 14th byte to the controller when the data received in the 
13th byte has no error. If a receive error is encountered, the device goes to an idle 
state after returning three bytes of relevant error code to the controller. 

The 15th through the 18th bytes respectively are bits 15 to 8 and bits 7 to 0 of the 
password comparison start address and are the data returned to the controller. 
For these operations, refer to paragraphs 7 and 8 above. 

The 19th through the m’th bytes are the password data. The number of passwords 
or the password count is the data (N) indicated by the password count storage 
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address. The password data are compared for N entries beginning with the 
password comparison start address. The contrdler should send N bytes of 
password data to the device. If the passwords do not match, the device goes to an 
idle state without returning error code to the controller. 

The receive data in the m’th + 1 through the n’th — 2 bytes are received as binary 
data in Extended Intel Hex format. No received data are echoed back to the 
controller. 

The RAM loader routine ignores the received data until it receives the start mark 
(3AH for “:”) in Extended Intel Hex format. Nor does it send error code to the 
controller. After receiving the start mark, the routine receives a range of data from 
data length to checksum. 

The received write data are successively written to the specified flash memory 
addresses. Since bits 23 to 16 of the address pointer during write are by default 
OOH, the first record type does not always have to be an extended record. 

After receiving one record of data from start mark to checksum, the routine goes to 
a start mark waiting state again. 

If a receive error or Extended Intel Hex format error occurs, the device goes to an 
idle state without returning nothing to the controller. 

Because the RAM loader routine executes a SUM calculation routine upon 
detecting the end record, the controller should be placed in a SUM waiting state 
after sending the end record to the device. 


The n’th — 1 and the n’th bytes are the SUM value that is sent to the controller in 
order of the upper byte and the lower byte. For details on how to calculate the SUM, 
refer to “Notes on SUM” in the latter page of this manual. The SUM calculation is 
performed only when no receive error or Extended Intel Hex format error has been 
encountered after detecting the end record. The time required to calculate the 

SUM is approximately proportional to the number of data written to RAM. The 

time required to calculate the SUM of a 4 Kbytes of RAM area, for example, is 

approximately 6 ms at fe = 20 MHz. After SUM calculation, the device sends the 

SUM data to the controller. The controller should determine whether writing to 

RAM has terminated normally depending on whether the SUM value is received 

after sending the end record to the device. 


The boot program jumps to the first address that is received as data in Extended 
Intel Hex format after sending the SUM to the controller. 


@ Flash memory SUM command (Table 3.5.5) 


The transmit/receive data in the Ist through the 4th bytes are the same as in the 
case of flash memory rewrite commands. 


The receive data in the 5th byte is the flash memory SUM command data (90H). 


The 6th byte is used to echo back the received data (in this case, 90H) to the 
controller when the data received in the 5th byte is one of the operation command 
data in Table 3.5.2. Then the flash memory SUM processing routine is called. If 
the received data is none of the operation command data, the device goes to an idle 
state after returning three bytes of operation command error code (63H) to the 
controller. 

The 7th and the 8th bytes are the SUM value that is sent to the controller in order 
of the upper byte and the lower byte. For details on how to calculate the SUM, 
refer to “Notes on SUM” in the latter page of this manual. 

The receive data in the 9th byte places the device in a state waiting for the next 
operation command data. 
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@ Boot program transmit data 


The boot program sends the processing status to the controller using various code. 
The transmit data (processing code) are listed in the table below. 


Table 3.5.6 Boot Program Transmit Data 


Transmit Data Meaning of Transmit Data 
Collective erase of flash memory chip terminated normally. 
62H, 62H, 62H Baud rate modification error occurred. 


Parity error in received data occurred. 


*4: When this receive error occurs when receiving data in Extended Intel Hex format, the device 
does not send the receive error code to the controller. 


©) Notes on SUM 


e Calculation method 
SUM consists of byte + byte* + + + * ++byte, the sum of which is returned in word 
as the result. Namely, data is read out in byte and sum of which is calculated, with 
the result returned in word. 


If the data to be calculated consists of the 
four bytes shown to the left, SUM of the data 
is 


A1H + B2H + C3H + D4H = 02EAH 


SUM (HIGH) = 02H 


SUM (LOW) = EAH 


The SUM returned when executing the flash memory rewrite command, RAM 
loader command, or flash memory SUM command is calculated in the manner 
shown above. 


e §«Calculation data 
The data from which SUM is calculated are listed in Table 3.5.7 below. 


Table 3.5.7 SUM Calculation Data 


‘ Data in the entire area (512 Kbytes) | The received flash memory or RAM write data is not 
Flash memory rewrite command 
of flash memory the only data to be calculated for SUM. Even when 


Data written in an area ranging from | the received addresses are noncontiguous and 


RAM loader command the first address received to the last | there are some unwritten areas, data in the entire 


address received memory area is calculated. 


Data in th ti 512 Kb 
Flash memory SUM command ata linthe enilte tea vies) 
of flash memory 
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©) Notes on Extended Intel Hex Format (binary) 

e For the flash memory rewrite command, always make sure the first record type is 
an extended record. This is because the internal flash memory of the TMP 94FD53 
is located in a memory space starting from address 10000H, so that bits 23 to 16 of 
the address pointer when writing to the flash memory are, by default, 00H. 

e For the RAM loader command, the first record type does not always have to be an 
extended record. This is because bits 23 to 16 of the address pointer when writing 
to the flash memory are, by default, OOH. 

e After receiving the checksum of a record, the device waits for the start mark (3AH 
for “:”) of the next record. Therefore, the device ignores all data received between 
records during that time unless the data is 3AH. 

e Make sure that once the controller program has finished sending the checksum of 
the end record, it does not send anything and waits for two bytes of data to be 
received (upper and lower bytes of SUM). This is because after receiving the 
checksum of the end record, the boot program calculates the SUM and returns the 
calculated SUM in two bytes to the controller. 

e Ifa write error (for only the flash memory rewrite command), receive error, or 
Extended Intel Hex format error occurs, the device goes to an idle state without 
returning error code to the controller. In the following cases, an Extended Intel 
Hex format error is assumed: 

When TYPE is not 00H, 01H, or 02H 

When a checksum error occurred 

When the data length of an extended record (TYPE = 02H) is not 02H 

When the address of an extended record (TYPE = 02H) is not 0000H 

When the data in the 2nd byte of an extended record (TYPE = 02H) is not 00H 
When the data length of the end record (TYPE = 01H) is not 00H 

When the address of the end record (TYPE = 01H) is not 0000H 


Example: When writing to an area from address 1FFF8H to address 2002FH, the 
transfer format should be like the one shown in Table 3.5.8. 


Table 3.5.8 Example of Transfer Format for Flash Memory Rewrite Command 


Direction of Data Meaning of Data 
Extended Intel Hex Format 
(n’th — 2 byte in item 8 of Table 3.5.3) 


Controller to TMP94FD53 : 00 0000 01 FF ww. 


SUM (upper byte) 
TMP94F D853 to controller (nth — 1 byte in Table 3.5.3) SUM (upper byte) 
SUM (lower byte) 
TMP94FD53 t troll SUM (| byt 
oa (n'th byte in Table 3.5.3) ower bye) 
Operati d 
Controller to TMP94FD53 ees asin oe 3.5.3) Next operation command data 


Note: The colon “:” denotes the start mark (3AH). 
xx, yy denote the data written to flash memory. 
CS, EC, DC, FF denote the checksum data. 
zz denotes the data that can be sent by the controller without causing a problem. 
ww denotes the data that cannot be sent by the controller. 
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@ Notes on Passwords 


The area in which passwords can be specified is located at addresses 72000H to 


8DFFFH. Figure 3.5.3 schematically shows the password area. 


Password comparison start address (PCSA) ——~> 


Password count storage address (PNSA) 
The content of the address specified by PNSA is the password count (N). In the 
following cases, a password error is assumed: 


PNSA < address 72000H 
Address 8DFFFH < PNSA 
N < 8 


Password comparison start address (PCSA) 
The passwords are compared beginning with the address specified by PCSA. The 
specified password area is from PCSA to PCSA +N. In the following cases, a 
password error is assumed: 
PCSA < address 72000H 
Address 8DFFFH < PCSA+N-1 
When the specified password area contains three or more consecutive bytes of 
the same data. However, if all data in the vector part (8FFOOH to 8FFFFH) are 
FFH, the device is assumed to be a blank product, in which no check is made of 
the passwords. 
Password string 
A string of passwords in the received data are compared with the data in the flash 
memory. In the following cases, a password error is assumed: 
When the received data does not match the data in the flash memory 
Handling of password error 


When a password error occurs, the device goes to an idle state. 


Flash memory 


Specifiable password area 


Specified password area 
(N entries) 


PNSA+N — 1 ———»> 


Figure 3.5.3 Conceptual Diagram of a Password Area 
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Single Boot General Flow 


Automatocally 
set baud rate 


Receive command 


Command = SUM? 


Command = 
Rewrite? 


Command = RAM 
Loader? 


Rewrite RAM Loader 


SUM processing ; : Send error code 
processing processing 


Jump to the user Go to idle state 
program's start address 
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(1) SUM command 


Calculate SUM of entire area 
Output upper byte of SUM 
Output lowre byte of SUM 


(2) Rewrite command 


Rewrite processing 


fl Erase flash i 


Yes 
Output erace OK code 
a Write HEX data it 


Send erase NG code 


Go to idle state 
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RAM loader 
Vector blank? 
Yes 


(3) RAM loader command 


Check for blank 


Enter password count 
storege address 


Enter password 
comparison start address 


Check passwords 


Three 
Consecutive bytes o 
ame data? 


x No 
Enter passw ords 


No 
Se 


Yes 


li Write HEX data i 
Execute user program 


Go to idle state 


Branch to RAM area 
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(2) -1 Writing HEX data 


Writing HEX data 
Enter data 


Yes 
Enter data length 
Enter address 
Enter type 


ype = 02? No 
extended record 


Yes 


Type = 01? No 


end record 


Yes 


Data record Extended record end record 
Go to idle state 
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(2) -1-1 Data record 


Receive first byte 


Yes 
RAM loader? 
No 
Yes 
Odd address? 


Remainder = 1? 
No 
: Read next address Read previous 
Write 1 word Write 1 byte to RAN 


Enter SUM 


i =0? 
Yes 
oe 
Yes 
Go to idle state 
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(2) -1-2 Extended record 


Extended record 
Data lengh = 02? 


Yes 
Address = 0000? 
Yes 
Enter pragraph 
address 
Set USBA 


UBSA: pragraph address 


Enter data 


Data = 00? 
Enter SUM 


Under Development (Preliminary) 


Go to idle state 
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(2) -1-3 End record 


No 

Data lengh = 00? 

Address = 0000? 

Enter SUM 

Yes 
Calculate SUM 
Output upper byte of 

pupae ey 


Output lower byte of 
SUM 
Com) 


Go to idle state 


TMP94FD53 
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(2) -1-1-1 Writing one word (2) -2 Flash mempry erase 


Erase flash 


Write 1 word 


ist cycle (3AAA8) = AA ist cycle (3AAA8) = AA 
2nd cycle (35554) = 55 2nd cycle (35554) = 55 
3rd cycle (3AAA8) = AO 3rd cycle 

Set write command 


Erese setup 


Write to specified 
address 
Hl Polling check E 


Write error? 


4th cycle 
5th cycle 
Yes 6th cycle 
Chip erase 
Go to idle state [Poti check | | 
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(2) -2-1 Data polling 


Polling check 
Read written data 


rite and — 
read polling bits 
matched? 


‘ead time-out bit = 1? 


Yes 
Read written data 


No 


Write and | 
read polling bits 
matched? 


Status = OK 
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4 Electrical Characteristics 


4.1 Absolute Maximum Ratings 


Power Supply Voltage 
-0.5 to VCC3+0.5 


Power Dissipation (Ta=85°C) JP, — = ll 
Soldering Temperature (10s) 


Operation Temperature 


Operation Temperature 
(FLASH Program/Erase) 


Number of Times Program Erased 


Note: The absolute maximum ratings are rated values that must not be exceeded during 
operation, even for an instant. Any one of the ratings must not be exceeded. If any 
absolute maximum rating is exceeded, a device may break down or its performance 
may be degraded, causing it to catch fire or explode resulting in injury to the user. 
Thus, when designing products that include this device, ensure that no absolute 
maximum rating value will ever be exceeded. 
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42 DC Electrical Characteristics 
Vec3 = 3.0 to 3. 6V / Vec5 =4 5V to 5. 5V / fc = 16 to 20MHz / Ta = -40 to 85°C 
——feroneter 1 Synbot __fond fog in fax Tn 
Sedge, |Meat a 
Mos | 


Input Low Vol tage 
P00 to P07 (D0 to 7) 03 V 
PCO to PG7 Vitg 
PLO to PL3 


Input Low Vol tage 

P00 to P07 (PORT) 

P40 to P47 

P70 to P75 

PCO to PC5 Vin 0. 3*VCC5 
PDO to PD? 

PFO to PF7 

PMO to PM7 

PNO to PN5 


Input Low Vol tage 
AMO to AMI 
TESTO to TESTI 


Input Low Vol tage 
XI Vii 


0. zeveca | 
Input High Voltage 
P00 to P07 (D0 to 7) 
PGO to PG7 


VEC5+0. 3 
PLO to PL3 


Input High Voltage 
POO to P07 
P40 to P47 
P70 to P75 
PCO to PC5 0. 7*VCC5 VCC5+0. 3 
PDO to PD? 
PFO to PF? 
PMO to PM? 
PNO to PN5 


Input High Voltage 
INTO vCC5+ 
iM Ving 0. 75*VCC5 CC5+0. 3 
RESET 

Input High Voltage 
AMO to AMI Ving vcc5-0.3 | VCC5+0. 3 
TESTO to TEST 


Input Low Vol tage 
INTO 
MI 0. 25*VCC5 
RESET 
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Symbol Condi tion P Min Max | Unit | 
Output Low Vol tage Vo. I. = 1. 6mA a 0. 45 V 


Vouo low = 400 uA 
Qutput High Vol tage Vout ly = -100 uA 


Input Leakage Current 


Qutput Leakage Current | | 


2 
75*VCC5 
Voue low = 20 WA 0. 9#VCC 


zr 


SCS Ss 


0.0 S Vin SVCC5 0. 02 (typ. ) 


LI } 

iy 00S Vin SVCC5 (PortG PortL) 0. 02 (typ. ) +0.5 

LO 0.2 S Vin S VCC5-0. 2 0. 05 (typ. ) 

nein Rs Vocg=3. 3V.. X1=10MHz (Internal 20MHz) sev 
(Single Chip) * (Includes | ccru) 

lees Vecg=5. OV F X1=10MHz (Internal 20MHz) 0. 5 (typ) 


lecsipLe2 |DLE2 Vecg=3. 6V, X1=1 QMHz (Internal 20MHz) 
Mode | Veog=5. 5V, X1=10MHz (Internal 20MHz) 


4 
5 


> 


Lu 


Mm. 


| ocsioLe2 
Operating Current leesipre; | IDLE! | Voc3=3. 6V, X1=10MHz (Internal 20MHz) 


Lee 
7 
| 
(Stand-by) Leesimer | MOS | Voog=5. 5V, X1=10MHz (Internal 20MHz) | 
== = 
a 


| CC3STOP STOP Voc3=3. 6V 


| cesstop te Vocs=9. OV 


VsoB3 Voos < Vops » 
Stand-by Voltage 
Vorp5 Vin <Voos + VinoSVoos + Vins<Voos 


Pull-up Resistor Rest 
Rox CLK 
10 


Pin Capacitance C fc= 1MHz aa 
Schmitt Width Via INTO, NMI, RESET | 04 | 


*: On condition that external bus don’t operate 


=> 


po ] pe 
ary an 


+5 
+10 
30 
20 
300 
300 
3.6 
9.5 
220 


RESET K 


1. 0 (typ. } 
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4 3AC Characteristics 


Read cycle VCC3=3.3V £0.3V, VCC5=5.0V-£10%, TA=-40 to 85°C 


(No [____—‘Paraneter «| «SomboT [Min Wax | “G20 | @TORZ | Thit | 
[2 [System Clock period FM ————Sid te [PTC 
PS [ROUT Low Width | ts PX | rs 
q TE LO I 
| a OA 
i ro [738 [1s _| 


ER 


1 | AO to A23 Valid DO to D/ Input @OWAIT 


— ty 
[SZ [AD to QS Valid 700 to D7 Inout @TWATT | tes [| 3 OXI | 100 
6-2 | RD Fall =D0 to D7 Inout @IWAIT| tes [CS 
PTT] low Wath CC OUMATT[ te | FOXTOT 
Te] lw wide SSC«WATT tes =| eOXT OO C*dLC‘iOGSOCYCTSOSC os 
[BPA to AB Valid RAT [te SP XTC CTs 
Por OKT tw SP OT C*dEC( “SST OCT os 
PTY AD to AB Valid Oto drword [tm [| OO CT SCT OCT SCs 
[if mRse Oto Dold Sidi S| OTC] SCCCCSCdT SCOTT SCs 
[Te] AD to ALS Valid PORT Inout [ste «| Sif OTT TCs 
[TS [AD to AB Valid PORT Hold | Sitw ~<| se OxT [CT SCTOOSC*SCHSCST os 
P14 [WRT Set-w Tine CdS CTCL CCCSC*dYCO Ts 
Pty WT foldtime ——SC~=“~*~*é~*sdSC“‘<‘i SY|~SCTCTSC~dYSC(<C‘CTSCdYTSCi CYC ‘i 
Write cycle VCC3=3.3V £0.3V, VCC5=5.0V + 10%, TA=-40 to 85°C 
[No [—S=*~*~*«éP rameter —=—=SSS*~*srSC« mb SYS in —=«?s=Ssx—=«Y;«C “| «TOW | Unit 
PT Wt period WK OTS =| SCSCHCSCSTSCTODCTHCOCST ons‘ 
[2 System Clock veriod FT dT Ste ~d[ SSC«TCSC TSC si 
3] OKT Cow Width SSCS~sSC“‘é SCP OTTO TCL SCOCOTSCCOTCrs 
PY CUKOUTT High Width te ~ST XTI TCTns_ | 
ST | D0 to D7 Valid WRRise —GOWATT [ty =< xT CC«dTCiBSCSEC S| ots 
D0 to D7 Valid=WR Rise @WAIT| ty [2 2XT=3H [BCBS ns 
WR Low Width T tw [texto ; | 3 | ® | os | 
25 XT-30 
| eae! PE RE aE 
PTT | AO to AS Valid PORT Outout | Stew | ~~ SSSC*d; CO | OCT SSCS 
OR 0 
WT Hold Time C—<“‘;~;*~drSCéi SCT St TTCSCCCSC~iY:~Sé SCS CTs 
P14] RO Rise DO To DT Outout ty = XT] CC Ts 
AC Condition 
@Output :  PoDVto D7), P4(A0 to A7), PD(A8 to A15), PM(A16 to A23), P70(RD), P71(WR) 
High 2.0V, Low 0.8V, CL=50pF 
Others 
High 2.0V, Low 0.8V, CL=50pF 
@input : PoWMOdtoD7) 
High 2.4V, Low 0.45V, CL=50pF 
Others 


High 0.8 VCC5, Low 0.2* VCC5 
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(1) Read cycle (0 wait) 


tos 


X1 


CLKOUT1 
(fc) 


IN] 
| 
IN] 


AO to A23 


DO to D7 


Port input 


Note : The phase relation between X1 input signal and the other signals is unsettled. 
The timing chart above is an example. 
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(2) Write cycle © wait) 


tose 


X1 


CLKOUT1 
(fc) 


IN] 
LZ | 
IN] 


wart ow a 


; £\ rN 


DOtoDT 2 


Data Output 
mc beng 


RD 
tapw 
Port output 


Note : The phase relation between X1 input signal and the other signals is unsettled. 
The timing chart above is an example. , 
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(3) Read cycle (1 wait) 


5 
S 
& 
jee) 
<j 


tans 


| 


ters 
: Roa 


DO to D7 : : < Data Input_D 


(4) Write cycle (1 wait) 
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4.4 AD Conversion Characteristics 


AVIN Analog Inout Voltage 


Analog Current for analog 
vol tage 
Total error 
Quantize error of +0 5LSB is included) 


Clock Cycle Tyex 
Clock Low Width 41+40 
Clock High Width lad 41+40 


4 6Serial Channel Timing 


(1) SCLK Input mode (1/0 Interface mode) 


SCLK Cycle 


SCLK Rise — Input Data Hold 
SCLK Rise — Input Data Valid 
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20MHz 16MHz 


Unit 
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SCLK 


OUTPUT DATA 
TxD 


INPUT DATA 
RxD 


4.7 Interrupt Operation 


ae ee oe oe]! 
NMI, INTO Low Width 


NMI, INTO High Width Tint a 
INTI~INT7 Low Width 8T+100 
INTI~INT7 High Width 8T+100 
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48 Serial Expansion Interface 


ta 
8S fall > SECLK Se a 
SECLK > SS rise ee a Pe es 


|TsckH__| SECLK High Pulse Width | Teyc/2-15| | BTSs 
|Tsckt___| SECLK Low Pulse Width | Teyc/2-t5 | | 8 T ns 
[Tsu Input Data Set-up Tcyc/4 | | Ts 
|Th | Input Data Hold =| Toye ||| s 
|Tv { Output Data Valid | Toye | Ts 
[Tho [Output DataHold = ts 


a) SEI Master (CPHA=0) 


LSB Input 
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c) SEI Slave (CPHA=0) 


$S 
SECLK 
SECLK 
>t i 
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5. Package 
Package Dimensions : P-LQFP100-1414-0.50C 


Unit : mm 


1.0TYP 


14.040.2 


1.85MAX 


15.0+0.2 


Ove5 oc 


94FD53 - PKG 


